registry / @kdtix-open/sdlca-bridge / 0.1.12

@kdtix-open/sdlca-bridge@0.1.12

⚠ Under review

Local execution bridge CLI for SDLC Automated — npx-ready installer

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis flagged 16 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 418 KB of source, external domains: auth.projectit.ai, sdlca.invalid, www.apple.com

Source & flagged code

7 flagged

bin/sdlca-bridge.jsView file

Lines 1-43javascript

1#!/usr/bin/env node

2// SPDX-License-Identifier: BSL-1.1

3var Ed=Object.defineProperty;var T=(e,r,t)=>()=>{if(t)throw t[0];try{return e&&(r=e(e=0)),r}catch(o){throw t=[o],o}};var Sd=(e,r)=>{for(var t in r)Ed(e,t,{get:r[t],enumerable:!0})};import gm from"path";import{fileURLToPath as mm}from"url";var h=T(()=>{"use strict"});function ie(e){if(e?.discoveryUrl!==void 0&&e?.clientId===void 0)throw new ne("oidc.clientId is required when oidc.discoveryUrl is overridden");let r={...Kt,...wd(e)};try{if(new URL(r.discoveryUrl).protocol!=="https:")throw new ne("oidc.discoveryUrl must use HTTPS")}catch(t){throw t instanceof ne?t:new ne("oidc.discoveryUrl must us ...

4`)}r.push([s,Pd(a.trimEnd())])}return r}function xd(e){if(e.length<2)return!1;let r=e[0];return r!=='"'&&r!=="'"?!1:e.indexOf(r,1)===-1}function Pd(e){return e.length>=2&&(e.startsWith('"')&&e.endsWith('"')||e.startsWith("'")&&e.endsWith("'"))?e.slice(1,-1):e}function Ad(e){return e==="~"?Vt.homedir():e.startsWith("~/")?se.join(Vt.homedir(),e.slice(2)):e}function Jt(e){try{return new URL(e).protocol==="https:"}catch{return!1}}function Wt(e){try{return new URL(e).protocol==="http:"}catch{return!1}}var Xr,kd,qt,K=T(()=>{"use strict";h();Te();Xr=4318,kd=/^[\w-]{1,128}$/u,qt=4096});import Md from" ...

6`)}catch{}}function uc(e){let r=Object.fromEntries(Object.entries(e).filter(([,t])=>t!==void 0).map(([t,o])=>[t,st(o)]));return ot(r)}function st(e){return e instanceof Error?{message:e.message,name:e.name,stack:e.stack??null}:e instanceof URL?e.toString():Array.isArray(e)?e.map(r=>st(r)):e&&typeof e=="object"?Object.fromEntries(Object.entries(e).map(([r,t])=>[r,st(t)])):e}var ze,nt,Zn,Rr=T(()=>{"use strict";h();kr();ze={error:0,info:1,debug:2,trace:3},Zn=""});import ti from"fs";import pc from"path";function Be(e,r=process.env){return ri({debug:e.debug,logsDir:$(r).logsDir,serviceName:"sdlca-b ...

7`)}function vs(e){try{let t=$u.readFileSync(e,"utf8").split(/\r?\n/u);return Object.fromEntries(ep(t))}catch{return{}}}function ep(e){let r=[];for(let t=

8`)}r.push([s,tp(a)])}return r}function rp(e){if(e.length<2)return!1;let r=e[0];return r!=='"'&&r!=="'"?!1:!e.endsWith(r)}function bs(e){return $e.resolve

9`;if(Buffer.byteLength(s,"utf8")>Hs){Wo(r,"reviewPatternService: corpus entry exceeds PIPE_BUF limit; truncating fields",{id:e.id,byteLength:Buffer.byteLength(s,"utf8")});let a=e.anti_pattern,d=e.fix_template;for(;Buffer.byteLength(s,"utf8")>Hs;){let u=a,l=d;if(a.length>0&&(a=a.slice(0,Math.max(0,a.length-Ms))),d.length>0&&(d=d.slice(0,Math.max(0,d.length-Ms))),i={...e,anti_pattern:a,fix_template:d},s=`${JSON.stringify(i)}

10`,a===u&&d===l){Wo(r,"reviewPatternService: corpus entry too large even after full truncation; skipping persistence (best-effort)",{id:e.id,byteLength:Buffer.byteLength(s,"utf8")});return}}}await It.appendFile(t,s,{mode:384}),n||await It.chmod(t,384)}catch(o){Wo(r,"reviewPatternService: failed to persist corpus entry; skipping (best-effort)",o)}}var Hs,Ms,Rp,bb,$s=T(()=>{"use strict";h();Hs=4096,Ms=64,Rp=Vo.resolve(process.cwd(),"data/review-pattern-corpus.jsonl"),bb=Vo.resolve(process.cwd(),"data/review-pattern-corpus-pending.jsonl")});import{randomUUID as Xo}from"crypto";import Tp from"path" ...

11`).replace(/\r/g,`

12`),t=[];for(let o of r.matchAll(Cp))t.push({file:o[1],line:Number.parseInt(o[2],10),col:Number.parseInt(o[3],10),severity:o[4],message:o[5],rule_id:o[6]});return t}function Ap(e,r,t){let o=new

13`).replace(/\r/g,`

14`),t=[];for(let o of r.split(`

15`)){let n=Bp(o);n&&t.push(n)}return t}function Bp(e){let r=e.indexOf(js);if(r===-1)return null;let t=e.lastIndexOf("(",r);if(t<=0||e.slice(0,t).includes("): "))return null;let[o,n]=e.slice(t+1,r).split(",");if(!/^\d+$/.test(o)||!/^\d+$/.test(n))return null;let i=e.slice(r+js.length),s=i.indexOf(":");if(s<=0)return null;let a=i.slice(0,s),d=i.slice(s+1).trimStart();return!/^\d+$/.test(a)||d.length===0?null:{file:e.slice(0,t),line:Number.parseInt(o,10),col:Number.parseInt(n,10),code:`TS${a}`,message:d}}function Hp(e){let r=e.replace(/\r\n/g,`

16`).replace(/\r/g,`

17`),t=[],o=null,n=()=>{o&&(t.push(o),o=null)};for(let i of r.split(`

18`)){let s=Ip.exec(i);if(s){n(),o={file:s[1],test_name:s[3],assertion_category:"unknown_assertion"};continue}if(!o||o.assertion_category!=="unknown_assertion")continue;let a=xp.exec(i);a&&(o.assertion_category=Mp(a[1]))}return n(),t}function Mp(e){return/\bto equal\b/.test(e)?"expected_to_equal":/\bto match\b/.test(e)?"expected_to_match":/\bto be truthy\b/.test(e)?"expected_truthy":/\bto throw\b/.test(e)?"expected_to_throw":"unknown_assertion"}var Cp,js,Ip,xp,Gs=T(()=>{"use strict";h();Bs();$s();Cp=/^(.+):(\d+):(\d+)\s{2,}(error|warning)\s{2,}(.+)\s{2,}([@A-Za-z0-9/_-]+)$/gm,js="): error TS",Ip ...

19${Q(a||s)}`,f??1,Q(a),Q(s)))}),t.timeoutMs&&t.timeoutMs>0&&(l=setTimeout(()=>{u=!0,i.kill("SIGTERM"),c=setTimeout(()=>{i.kill("SIGKILL")},1e3)},t.timeoutMs)),t.input&&i.stdin.write(t.input),i.stdin.end

20// This file is managed automatically.

21${JSON.stringify(u,null,2)}

22`,{mode:384}),await G.chmod(o,384)}async function cg(e){try{let t=(await G.readFile(e,"utf8")).split(`

23`).filter(n=>!n.trimStart().startsWith("//")).join(`

24`).trim();if(!t)return{};let o=JSON.parse(t);return o!==null&&typeof o=="object"&&!Array.isArray(o)?o:{}}catch(r){if(r.code==="ENOENT")return{};throw r}}function lg(e,r,t){return{...t??{},COPILOT_ALLOW_ALL:"true",COPILOT_AUTO_UPDATE:"false",COPILOT_DEBUG_BROWSER:ug(),COPILOT_HOME:e,GITHUB_MCP_SERVER_TOKEN:aa(t?.GITHUB_MCP_SERVER_TOKEN,t?.GH_TOKEN,t?.GITHUB_TOKEN)??r}}function aa(...e){for(let r of e){let t=r?.trim();if(t)return t}}function ug(){return JSON.stringify([process.execPath,"-e","process.exit(0)"])}function pg(e){let r=e?.trim();return r?/^https?:\/\//i.test(r)?r:`https://${r}`:"http ...

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

bin/sdlca-bridge.jsView on unpkg · L2

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

bin/sdlca-bridge.jsView on unpkg · L2

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/sdlca-bridge.jsView on unpkg · L2

25# No-op GUI launcher for headless worker environments (#983)

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/sdlca-bridge.jsView on unpkg · L23

26exit 0

27`,rn=null});var Lt,mr,Nt,Bt,Kr,tn,on=T(()=>{"use strict";h();Lt="SDLCA_LOCAL_EXECUTION_BRIDGE_TOKEN must be configured.",mr="The supplied bridge token is invalid.",Nt="Dispatch blocked: credential preflight failed. Re-authenticate the affected service and restart the bridge.",Bt="Forensic execution is disabled on this bridge. Set SDLCA_BRIDGE_FORENSIC_ENABLED=true once the Token Reporting API contract is approved in issue #1244.",Kr="sdlca.bridge.forensic.v0",tn={artifactKinds:["local_model_forensic_review"],artifactSchemaVersion:Kr,emitsRawAdminSnapshots:!1,executionKind:"forensic",requiresAd ...

28`)}catch(d){this.pending.delete(o),clearTimeout(a),s(d instanceof Error?d:new Error(String(d)))}})}text(){return this.textChunks.join("")}async close(){this.closed=!0,this.rejectAll(new Error("ACP adapter process is closing.")),this.lines.close(),!(this.child.exitCode!==null||this.child.signalCode!==null)&&(this.child.stdin.end(),await new Promise(r=>{let t=!1,o,n=()=>{t||(t=!0,clearTimeout(i),o&&clearTimeout(o),this.child.removeListener("close",n),r())},i=setTimeout(()=>{this.child.kill(

29`),vr=["[SYN/SYN-ACK/ACK bridge verification handshake]","Your role: reviewer",`Your provider ID: ${q.providerId}`,`Peer worker provider ID: ${L.providerId}`,"","Output ONLY the following JSON (no prose, no markdown code fences):",`{"acknowledged":true,"role":"reviewer","providerId":"${q.providerId}"}`].join(`

30`),Re="passed",yn,Le;try{let B=await e.executeStructuredAgent({executionKind:"handshake",environment:Vr(L.kind,Hr,o,r),prompt:Gt,provider:{executable:mn(L.kind,e.resolveExecutable),kind:L.kind},schema:qr,workingDirectory:Ee});B.acknowledged!==!0?(Re="failed",Le=`Worker handshake for ${L.providerId} failed: acknowledged=${String(B.acknowledged)}`):B.role!=="worker"?(Re="failed",Le=`Worker handshake for ${L.providerId} failed: expected role="worker", got "${String(B.role??"(absent)")}"`):B.providerId!==L.providerId&&(Re="failed",Le=`Worker handshake for ${L.providerId} failed: expected providerI ...

31`)),t})(),i=Rs(n,e,r),s=ks(n,e,r,{excludeLegacyCopilotCliSource:i!==void 0}),a=r==="worker"&&t.workerGitAuthorName&&t.workerGitAuthorEmail?{name:t.workerGitAuthorName,email:t.workerGitAuthorEmail}:void 0,d=s?Ts(s,{includeCredentialBreadcrumbs:t.providerGitHubCredentialBreadcrumbs===!0,includeLegacyUatAlias:t.providerGitHubLegacyUatAlias===!0,copilotAuthCredential:i,workerGitIdentity:a}):{},u={...Dt,PATH:`${ba()}:${process.env.PATH??""}`,...d};switch(e){case"claude":return{...u,...t.anthropicApiKey?{ANTHROPIC_API_KEY:t.anthropicApiKey}:{}};case"cursor":return{...u,...t.cursorApiKey?{CURSOR_API_ ...

32`),process.exit(1)}console.log("Starting bridge in foreground mode (Ctrl-C to stop)...");try{await bn(void 0,r)}catch(t){let o=t instanceof Error?t.message:String(t);process.stderr.write(`foreground: failed to start bridge server: ${o}

33`),process.exit(1)}}var md=T(()=>{"use strict";h();K();gd()});h();import _d from"fs";import Ft from"path";import{fileURLToPath as vd}from"url";h();K();import Xe from"fs";import Vd

34 "hostedWorkClaimPolling": false,

35 "oidcTransition": true,

36 "port": 4318

37}

38`;function In(e=process.env){let r=$(e);return pe.mkdirSync(r.home,{recursive:!0}),yr(r.configFile,Ld),yr(r.configExampleFile,Xt("config.json.example")),yr(r.credentialsExampleFile,Xt(".env.credentials.example"),384),yr(r.setupGuideFile,Xt("SETUP.md")),yr(r.credentialsFile,Nd(e),384),

39`)}function Bd(e,r){let t=pe.readFileSync(e,"utf8");if(new RegExp(`^\\s*${Er}\\s*=\\s*\\S+`,"mu").test(t))return;let o="";t.length>0&&!t.endsWith(`

40`)&&(o+=`

41`),t.trim().length>0&&(o+=`

42`);let n=`${o}# Required by local bridge loopback auth.

43${Er}=${xn(r)}

Long lines were clipped for display.

Source & flagged code

7 flagged · loading source

bin/sdlca-bridge.jsView file

2// SPDX-License-Identifier: BSL-1.1 L3: var Ed=Object.defineProperty;var T=(e,r,t)=>()=>{if(t)throw t[0];try{return e&&(r=e(e=0)),r}catch(o){throw t=[o],o}};var Sd=(e,r)=>{for(var t in r)Ed(e,t,{get:r[t],enumerable:!0})}... L4: `)}r.push([s,Pd(a.trimEnd())])}return r}function xd(e){if(e.length<2)return!1;let r=e[0];return r!=='"'&&r!=="'"?!1:e.indexOf(r,1)===-1}function Pd(e){return e.length>=2&&(e.starts... L5: `;u===ze.error?process.stderr.write(c):process.stdout.write(c),u<=ze.info&&Zt(t,c),e.debug>=1&&u<=ze.debug&&Zt(o,c),(e.verbose>=ze.trace||e.debug>=ze.trace)&&Zt(n,c)})}function Zt(... L6: `)}catch{}}function uc(e){let r=Object.fromEntries(Object.entries(e).filter(([,t])=>t!==void 0).map(([t,o])=>[t,st(o)]));return ot(r)}function st(e){return e instanceof Error?{mess... L7: `)}function vs(e){try{let t=$u.readFileSync(e,"utf8").split(/\r?\n/u);return Object.fromEntries(ep(t))}catch{return{}}}function ep(e){let r=[];for(let t=0;t<e.length;t+=1){let o=e[... ... L23: `).filter(n=>!n.trimStart().startsWith("//")).join(` L24: `).trim();if(!t)return{};let o=JSON.parse(t);return o!==null&&typeof o=="object"&&!Array.isArray(o)?o:{}}catch(r){if(r.code==="ENOENT")return{};throw r}}

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

bin/sdlca-bridge.jsView on unpkg · L2

2Trigger-reachable chain: manifest.bin -> bin/sdlca-bridge.js L2: // SPDX-License-Identifier: BSL-1.1 L3: var Ed=Object.defineProperty;var T=(e,r,t)=>()=>{if(t)throw t[0];try{return e&&(r=e(e=0)),r}catch(o){throw t=[o],o}};var Sd=(e,r)=>{for(var t in r)Ed(e,t,{get:r[t],enumerable:!0})}... L4: `)}r.push([s,Pd(a.trimEnd())])}return r}function xd(e){if(e.length<2)return!1;let r=e[0];return r!=='"'&&r!=="'"?!1:e.indexOf(r,1)===-1}function Pd(e){return e.length>=2&&(e.starts... L5: `;u===ze.error?process.stderr.write(c):process.stdout.write(c),u<=ze.info&&Zt(t,c),e.debug>=1&&u<=ze.debug&&Zt(o,c),(e.verbose>=ze.trace||e.debug>=ze.trace)&&Zt(n,c)})}function Zt(... L6: `)}catch{}}function uc(e){let r=Object.fromEntries(Object.entries(e).filter(([,t])=>t!==void 0).map(([t,o])=>[t,st(o)]));return ot(r)}function st(e){return e instanceof Error?{mess... L7: `)}function vs(e){try{let t=$u.readFileSync(e,"utf8").split(/\r?\n/u);return Object.fromEntries(ep(t))}catch{return{}}}function ep(e){let r=[];for(let t=0;t<e.length;t+=1){let o=e[... ... L23: `).filter(n=>!n.trimStart().startsWith("//")).join(` L24: `).trim();if(!t)return{};let o=JSON.parse(t);return o!==null&&typeof o=="object"&&!Array.is…

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

bin/sdlca-bridge.jsView on unpkg · L2

5`;u===ze.error?process.stderr.write(c):process.stdout.write(c),u<=ze.info&&Zt(t,c),e.debug>=1&&u<=ze.debug&&Zt(o,c),(e.verbose>=ze.trace||e.debug>=ze.trace)&&Zt(n,c)})}function Zt(... L6: `)}catch{}}function uc(e){let r=Object.fromEntries(Object.entries(e).filter(([,t])=>t!==void 0).map(([t,o])=>[t,st(o)]));return ot(r)}function st(e){return e instanceof Error?{mess... L7: `)}function vs(e){try{let t=$u.readFileSync(e,"utf8").split(/\r?\n/u);return Object.fromEntries(ep(t))}catch{return{}}}function ep(e){let r=[];for(let t=0;t<e.length;t+=1){let o=e[...

High

Child Process

Package source references child process execution.

bin/sdlca-bridge.jsView on unpkg · L5

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/sdlca-bridge.jsView on unpkg · L2

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

bin/sdlca-bridge.jsView on unpkg · L2

23`).filter(n=>!n.trimStart().startsWith("//")).join(` L24: `).trim();if(!t)return{};let o=JSON.parse(t);return o!==null&&typeof o=="object"&&!Array.isArray(o)?o:{}}catch(r){if(r.code==="ENOENT")return{};throw r}}function lg(e,r,t){return{.... L25: # No-op GUI launcher for headless worker environments (#983)

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/sdlca-bridge.jsView on unpkg · L23

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/sdlca-bridge.jsView on unpkg · L2

Findings

2 Critical3 High5 Medium6 Low

CriticalCredential Exfiltrationbin/sdlca-bridge.js

CriticalTrigger Reachable Dangerous Capabilitybin/sdlca-bridge.js

HighChild Processbin/sdlca-bridge.js

HighSame File Env Network Executionbin/sdlca-bridge.js

HighCommand Output Exfiltrationbin/sdlca-bridge.js

MediumDynamic Requirebin/sdlca-bridge.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencebin/sdlca-bridge.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

7 flagged

bin/sdlca-bridge.jsView file

Lines 1-43javascript

1#!/usr/bin/env node

2// SPDX-License-Identifier: BSL-1.1

7`)}function vs(e){try{let t=$u.readFileSync(e,"utf8").split(/\r?\n/u);return Object.fromEntries(ep(t))}catch{return{}}}function ep(e){let r=[];for(let t=

8`)}r.push([s,tp(a)])}return r}function rp(e){if(e.length<2)return!1;let r=e[0];return r!=='"'&&r!=="'"?!1:!e.endsWith(r)}function bs(e){return $e.resolve

11`).replace(/\r/g,`

12`),t=[];for(let o of r.matchAll(Cp))t.push({file:o[1],line:Number.parseInt(o[2],10),col:Number.parseInt(o[3],10),severity:o[4],message:o[5],rule_id:o[6]});return t}function Ap(e,r,t){let o=new

13`).replace(/\r/g,`

14`),t=[];for(let o of r.split(`

16`).replace(/\r/g,`

17`),t=[],o=null,n=()=>{o&&(t.push(o),o=null)};for(let i of r.split(`

20// This file is managed automatically.

21${JSON.stringify(u,null,2)}

22`,{mode:384}),await G.chmod(o,384)}async function cg(e){try{let t=(await G.readFile(e,"utf8")).split(`

23`).filter(n=>!n.trimStart().startsWith("//")).join(`

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

bin/sdlca-bridge.jsView on unpkg · L2

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

bin/sdlca-bridge.jsView on unpkg · L2

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/sdlca-bridge.jsView on unpkg · L2

25# No-op GUI launcher for headless worker environments (#983)

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/sdlca-bridge.jsView on unpkg · L23

26exit 0

33`),process.exit(1)}}var md=T(()=>{"use strict";h();K();gd()});h();import _d from"fs";import Ft from"path";import{fileURLToPath as vd}from"url";h();K();import Xe from"fs";import Vd

34 "hostedWorkClaimPolling": false,

35 "oidcTransition": true,

36 "port": 4318

37}

39`)}function Bd(e,r){let t=pe.readFileSync(e,"utf8");if(new RegExp(`^\\s*${Er}\\s*=\\s*\\S+`,"mu").test(t))return;let o="";t.length>0&&!t.endsWith(`

40`)&&(o+=`

41`),t.trim().length>0&&(o+=`

42`);let n=`${o}# Required by local bridge loopback auth.

43${Er}=${xn(r)}

Long lines were clipped for display.